feat(webhook): forward CP API key, add label trigger, optional review caps

[jainakshay93]

What & why

Three improvements to the GitHub webhook handler (app.py), found running pr-af self-hosted with control-plane auth on a small shared host. All are opt-in / non-breaking.

1. Forward the control-plane API key (bug fix)

_fire_review POSTs to /api/v1/execute/async/pr-af.review with no auth header. When the control plane runs with auth enabled (AGENTFIELD_API_KEY set), that call 401s — so the webhook silently never dispatches a review. Now it forwards AGENTFIELD_API_KEY as X-API-Key when set.

2. Label trigger (feature)

Adds a pull_request labeled handler: applying a configurable label (PR_AF_LABEL, default pr-af) to a PR fires a review — an alternative to the @pr-af comment mention. Handy where teams prefer a label, or where GitHub Actions can't run.

3. Optional review caps for webhook runs (feature)

Webhook-triggered reviews can now read optional per-deployment limits, applied only when set (default behaviour unchanged):

• PR_AF_MAX_CONCURRENT_REVIEWERS
• PR_AF_MAX_REVIEW_DEPTH
• PR_AF_MAX_COVERAGE_ITERATIONS
• PR_AF_IGNORE_PATHS (comma-separated)

This lets a small/shared host bound resource use (e.g. max_concurrent_reviewers=1, max_review_depth=0) without patching code — the default fan-out (concurrency 8, deep sub-reviews) can exhaust memory on a modest box and deadlock on very large PRs.

Notes

• No behaviour change when none of the new env vars are set and the control plane has no auth.
• .env.example documents all new vars.
• Builds on the webhook handler already present; complements fix: fall back to harness when .ai() structured output is unsupported #60 / fix: reconstruct diff from per-file patches when GitHub 406s on large PRs #61.

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[AbirAbbas]

Pushed a takeover pass to get this merge-ready — the base feature is unchanged, thanks @jainakshay93. What's new on top of the original commit (plus a merge of current main):

• Go node parity (the default install since Installing this repo gives you the Go node, as pr-af #64): the Go webhook previously rejected every pull_request event and sent no auth header, so none of this PR's fixes reached default installs. X-API-Key forwarding, the PR_AF_LABEL labeled-trigger, and the cap payload now also live in go/internal/node/webhook.go, with tests using an injected transport.
• NODE_ID dispatch fix: _fire_review posted to hard-coded pr-af.review; it now uses the configured NODE_ID (the Go side already did).
• Cap validation on both sides: malformed or below-minimum values are logged and ignored instead of 500ing the webhook (concurrency ≥ 1, depth ≥ 0, iterations ≥ 1 — concurrency 0/negative previously hung or crashed).
• Concurrency-1 deadlock fix: with max_concurrent_reviewers=1 (this PR's headline use case) a spawned sub-review deadlocked behind its parent's semaphore permit; parents now release their permit before awaiting children, with a regression test. The Go orchestrator is structurally immune.
• Label-trigger dedupe: bounded delivery-ID LRU + 10-minute per-PR TTL on both nodes, so redeliveries and bot label loops can't fire duplicate paid reviews (in-memory by design — single-process webhook; noted in code).
• Dropped PR_AF_IGNORE_PATHS: it was parsed and forwarded but nothing in either pipeline reads ignore_paths, so it was an inert knob. Real diff filtering is follow-up work.
• Manifests/docs: PR_AF_LABEL and the three cap vars are now declared in both agentfield-package.yamls and the Go README env table.

Gates: ruff clean, pytest 79 passed, go build/vet/test/gofmt clean, CI green.